{"id":"CVE-2026-112363","kind":"vulnerability","aliases":["CVE-2026-112363"],"related":[],"title":"Crawl4AI: unauthenticated SSRF in Docker API probes internal hosts","description":"Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.","summary":"Crawl4AI versions 0.8.7 through 0.9.5 have a server-side request forgery flaw in their Docker API server. An unauthenticated attacker can send crafted URLs with userinfo that bypass destination checks, making the server connect to internal hosts on port 443 and leak certificate details.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","crawl4ai","docker","python","self-hosted"],"not_affected_if":["library-only-use","no-docker-api-server"],"how_to_check":"- Check the installed Crawl4AI version with `pip show crawl4ai` or the image tag used in your Docker deployment.\n- Check whether the Docker API server is reachable from untrusted networks, since the sources do not say whether a default config exposes it.","fix":"- Upgrade Crawl4AI to a version later than `0.9.5`; the sources do not name the patched release.\n- Until patched, block the Crawl4AI Docker API from untrusted networks and restrict outbound access from its container to internal hosts.","status":"open","published_at":"2026-10-19T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:45+00:00","updated_at":"2026-10-25T03:40:45+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:40:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Crawl4AI to a version later than `0.9.5`; the sources do not name the patched release.\n- Until patched, block the Crawl4AI Docker API from untrusted networks and restrict outbound access from its container to internal hosts.","reach":"internet","title":"Crawl4AI: unauthenticated SSRF in Docker API probes internal hosts","impact":"low","summary":"Crawl4AI versions 0.8.7 through 0.9.5 have a server-side request forgery flaw in their Docker API server. An unauthenticated attacker can send crafted URLs with userinfo that bypass destination checks, making the server connect to internal hosts on port 443 and leak certificate details.","category":"ai-tooling","nicknames":[],"who_cares":["crawl4ai","docker","self-hosted","python"],"confidence":0.6,"needs_auth":"no","worst_case":"Server probes internal hosts and leaks their certificate details.","analyst_note":"Confirm the patched Crawl4AI version and whether the Docker API server is exposed by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112363 or the project's advisory.","how_to_check":"- Check the installed Crawl4AI version with `pip show crawl4ai` or the image tag used in your Docker deployment.\n- Check whether the Docker API server is reachable from untrusted networks, since the sources do not say whether a default config exposes it.","needs_analyst":true,"not_affected_if":["library-only-use","no-docker-api-server"],"who_is_affected":"Teams running the Crawl4AI Docker API server in versions 0.8.7 through 0.9.5 are exposed, especially if it accepts requests from untrusted clients. The sources say the attack needs fetch_ssl_certificate=true in the request, so deployments that never receive such requests are less exposed. Library-only users who do not run the Docker API server are likely not affected, but the sources do not state this directly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3374,"output_tokens":719,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112363':12A,15A '-2026':11A,14A '0.8.7':27B,72C '0.9.5':29B,74C '443':65B,121C 'ai':17B 'ai-tool':16B 'allow':89C 'api':6A,41B,86C 'attack':45B,91C,101C 'bypass':53B,93C 'certif':68B,106C,126C 'check':55B,95C 'connect':59B,115C 'contain':75C 'craft':48B,109C 'crawl4ai':1A,19B,25B,70C 'cve':10A,13A 'destin':54B,94C 'detail':69B,127C 'differ':100C 'docker':5A,20B,40B,85C 'fetch':104C 'flaw':37B 'forgeri':36B,81C 'host':9A,24B,62B,118C 'intern':8A,61B,117C 'leak':67B,125C 'make':56B 'pars':99C 'port':64B,120C 'probe':7A,122C 'python':21B 'reachabl':123C 'request':35B,80C 'self':23B 'self-host':22B 'send':47B 'server':33B,42B,58B,78C,87C 'server-sid':32B,77C 'set':103C 'side':34B,79C 'ssl':105C 'sslcertificate.from':113C 'ssrf':3A 'tool':18B 'true':107C 'unauthent':2A,44B,90C 'url':49B,97C,111C,114C 'userinfo':51B,98C,110C 'version':26B 'via':96C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Crawl4AI Docker API server in versions 0.8.7 through 0.9.5 are exposed, especially if it accepts requests from untrusted clients. The sources say the attack needs fetch_ssl_certificate=true in the request, so deployments that never receive such requests are less exposed. Library-only users who do not run the Docker API server are likely not affected, but the sources do not state this directly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112363","severity":null,"published_at":"2026-10-19T16:17:07+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}